NEVPNProtocolIPSec Certificate Not Trusted (iOS 8)

I'm trying to setup a VPN connection from code. I'm able to do most of the configuration I need. However, when I've installed the VPN configuration, under 'Signed by' it says 'Not Signed'. I would like to sign the certificate with another certificate, but I'm not sure how I can do that.


This is the code I've got so far.

[vpnManager loadFromPreferencesWithCompletionHandler:^(NSError * __nullable error) {
     if ([vpnManager protocol] == nil) {

          NEVPNProtocolIPSec *protocol = [[NEVPNProtocolIPSec alloc] init];
          protocol.serverAddress = @"vpn.server.com";
          protocol.authenticationMethod = NEVPNIKEAuthenticationMethodCertificate;
          protocol.useExtendedAuthentication = YES;
          NSURL *pkcs12URL = [[NSBundle mainBundle] URLForResource:@"Certificates" withExtension:@"p12"];
          NSData *identityData = [[NSData alloc] initWithContentsOfURL:pkcs12URL];
          protocol.identityData = identityData;

          vpnManager.protocol = protocol;
          vpnManager.enabled = YES;
          [vpnManager saveToPreferencesWithCompletionHandler:^(NSError * __nullable error) {
               [vpnManager.connection startVPNTunnelAndReturnError:nil];
          }];
     }
}];
Answered by DTS Engineer in 29343022

However, when I've installed the VPN configuration, under 'Signed by' it says 'Not Signed'.

There's no way to do this for a profile installed by the Network Extension framework. This is a known bug, but if this problem is affecting your app specifically you should feel free to put those details in your own bug report.

Please post your bug number, just for the record.

Share and Enjoy

Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

I know it is possible to do this by manually installing the 'other' certificate to verify the identity, for example by downloading it from Safari or Mail. However, I'm wondering whether it is possible to add this certificate to the Apple Keychain from code. Any ideas or is this not possible?

Accepted Answer

However, when I've installed the VPN configuration, under 'Signed by' it says 'Not Signed'.

There's no way to do this for a profile installed by the Network Extension framework. This is a known bug, but if this problem is affecting your app specifically you should feel free to put those details in your own bug report.

Please post your bug number, just for the record.

Share and Enjoy

Quinn "The Eskimo!"
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"
NEVPNProtocolIPSec Certificate Not Trusted (iOS 8)
 
 
Q